November 7, 2026 · Jurisdiction Briefing · 9 min read

ADGM: how a suspicion travels from an employee to goAML under AML Chapter 14

Chapter 14 of the FSRA’s Anti-Money Laundering and Sanctions Rulebook, AML VER11.210526, governs what happens inside a firm between someone noticing something and a report reaching the UAE Financial Intelligence Unit (FIU). This briefing follows a suspicion along that route, step by step, and adds the two pieces that sit outside the chapter but decide whether the route works: the training Rules in Chapter 13, and the federal law behind the report itself.

Two layers, and who is covered

The duty to report is federal. The Rulebook’s overview says Chapter 14 contains the obligations concerning SAR/STRs, which are required to be made under Federal AML Legislation, and Federal AML Legislation applies in ADGM. It includes Cabinet Resolution No. (134) of 2025, the executive regulations of Federal Decree by Law No. (10) of 2025, which the Rulebook calls the AML Regulations.

Article (18)(1) of the AML Regulations applies to Financial Institutions, DNFBPs and Virtual Asset Service Providers that suspect, or have reasonable grounds to suspect, that a Transaction or attempted Transaction, or funds, in whole or in part, constitute proceeds, are related to the Crime, or are intended to be used in it, regardless of their value. They must, without invoking banking secrecy, professional secrecy or contractual liability, notify the FIU “immediately and without delay”, with all available data and information on the Transaction or funds and related parties, through the FIU’s electronic system or any other approved means. They must also promptly respond to any FIU request for additional information. Article (18)(2) exempts lawyers, notaries, other independent legal professionals and independent statutory auditors for information obtained in the circumstances it lists, or in other circumstances subject to professional secrecy.

The Rulebook adds the internal process. Under Rule 1.2.1(2), Chapters 13 and 14 apply to Authorised Persons other than Credit Rating Agencies, to Recognised Bodies, to Representative Offices and to DNFBPs. An NPO gets Chapter 16 only. The Rulebook also warns that it should not be relied on to interpret Federal AML Legislation, and tells firms to refer to the legislation itself and to guidance issued under it.

Step 1: noticing it

Rule 14.2.1 requires policies, procedures, systems and controls to monitor and detect suspicious activity or Transactions. Guidance under Rule 14.2 lists circumstances that might give rise to suspicion, among them Transactions with no apparent purpose or obvious economic sense, a customer’s refusal to provide requested information without reasonable explanation, a new relationship used for a single Transaction or a very short period, and unnecessary routing of funds through third-party accounts. Separately, Article (17) of the AML Regulations requires firms to establish indicators for identifying suspicion of a Crime, and to update them on an ongoing basis.

The Guidance is also careful about the line between odd and suspicious:

> “the unusual is, in the first instance, only a basis for further inquiry”

That inquiry may call for judgement on whether the activity is suspicious, and timing is not fixed at the first look. A Transaction may not be suspicious at the time, but if suspicions are raised later, the obligation to report arises then.

Step 2: the employee tells the MLRO

Rule 14.2.2 is the hinge of the chapter. The firm must ensure that whenever an Employee, acting in the ordinary course of their employment, knows, suspects or has reasonable grounds for knowing or suspecting that a Person is engaged in or attempting money laundering or terrorist financing, that Employee promptly notifies the MLRO and provides all relevant details.

Four details in and around that Rule are easy to miss.

“Employee” is wider than the payroll. The Glossary covers an individual employed or appointed under a contract of service or for services or otherwise, and an individual whose services are placed at the firm’s disposal and under its control by arrangement with a third party.
There need not be a customer. Guidance says the requirement should include situations where no business relationship was developed because the circumstances were suspicious.
A line manager cannot be the last word. A firm may allow Employees to consult their line managers first. The FSRA would expect that this does not prevent a report, and the responsibility stays with the Employee to decide for themselves whether to notify the MLRO.
Nobody has to name the crime. Guidance says an Employee, including the MLRO, would not be expected to know the exact nature of the criminal offence, or that the funds definitely arose from money laundering or terrorist financing.

Rule 14.2.3 requires policies and procedures so that disciplinary action can be taken against an Employee who fails to report. Guidance adds that a firm may consider implementing policies under which such action is taken. On the other side, Rule 4.8.1 says a firm must not prejudice an Employee who discloses information about money laundering to the FSRA or another relevant body, which the Guidance says would include the FIU.

Step 3: the MLRO decides

Under Rule 14.3.1, on receiving an internal notification the MLRO must, without delay, investigate and document the circumstances, determine whether a SAR/STR must be made in accordance with Federal AML Legislation and document that determination, and, if required, make a SAR/STR as soon as practicable.

Rule 14.3.2 requires the MLRO to document the steps taken to investigate and, where no external report is made, the reasons. Rule 14.3.3 puts a matching duty on the firm to record the reasons for not making a report. Rule 14.3.4 requires the firm to ensure that a decision by the MLRO to make a SAR/STR is made independently and is not subject to the consent or approval of any other Person.

Neither Chapter 14 nor Article (18) of the AML Regulations gives a number of hours or days for the report. The words are promptly for the Employee, without delay and as soon as practicable for the MLRO, and immediately and without delay in the federal text.

Step 4: filing on goAML

Rule 14.3.5 requires firms to register on goAML upon receipt of their Financial Services Permission, Recognition Order or registration licence, in order to submit SAR/STRs. That is a day-one duty, not something to arrange when the first report is due. Guidance says failure to register may lead to the FSRA taking action, and that the mechanism for registering and reporting is available on the FSRA’s website.

Two content points come from the Rulebook. Where a firm knows or assumes that the funds do not belong to a customer but to a third party, Guidance says this fact, and the firm’s proposed course of further action, should be included in the report. For Jurisdictions Subject to a Call for Action, Rule 4.9.3 requires firms to comply with their internal reporting mechanisms under Chapter 14 and to submit suspicious transaction reporting to the FIU using the appropriate templates in goAML where relevant.

Step 5: the transaction, and the customer

Rule 14.4.1 holds the transaction until the FIU has been told: a firm must not carry out Transactions it knows, suspects or has reasonable grounds for knowing or suspecting to be related to money laundering or terrorist financing until it has informed the FIU under Rule 14.3.1.

After a filing, Guidance says the FIU may instruct the firm on how to continue the relationship, including effecting any Transaction. If the customer wants to move the funds before that instruction arrives, the firm should immediately contact the FIU for further instructions. The FIU also has its own powers. Under Article (51) of the AML Regulations, its Chief may order the suspension or cessation of a Transaction suspected of being related to the Crime for not more than ten working days, and the freezing of funds suspected of being linked to a Crime for thirty days, in each case without prior notice and based on the FIU’s analysis of reports and other information. The Attorney General or their delegate may amend or revoke a freezing decision, and may extend a freeze on the FIU’s request.

Tipping off runs through all of this. Guidance under Rule 14.4 reminds firms that under Federal AML Legislation they and their Employees must not tip off any Person. Article (19)(1) of the AML Regulations prohibits firms and their directors, officers and employees from disclosing, directly or indirectly, to the customer or anyone else that they have submitted or are about to submit a report, any related information or data, or that an investigation is being conducted, without prejudice to information sharing within the Financial Group under Article (32).

If a firm reasonably believes that performing CDD will tip off a customer or potential customer, it may choose not to pursue that process and should file a report. Rule 8.7.1(2) similarly releases a firm from the listed steps on incomplete CDD, such as terminating or suspending a relationship, where taking them would amount to tipping off or where the FIU directs otherwise.

Separately, Guidance under Rule 14.6 notes that the FSRA has powers under FSMR to restrict an Authorised Person or Recognised Body from disposing of or transferring property, and may apply to the ADGM Courts to restrain a Person from transferring or disposing of assets suspected of relating to money laundering or terrorist financing. It says the FSRA will usually act in coordination with the FIU in such cases.

The criminal law behind it

The Rulebook reminds firms that failing to report suspicions of money laundering and “tipping off” may each constitute a criminal offence punishable under the laws of the UAE. It also says that, under Article 37 of the AML Law, Relevant Persons and their Directors and Employees are protected from criminal, civil or administrative penalty or sanction when providing information, including confidential information, as part of a good faith report made under Federal AML Legislation to relevant regulatory bodies.

The paper trail

Rule 14.5.1 requires details of internal notifications and filed reports to be kept for at least six years from the date of the report. Rule 4.5.1 is wider. It also covers internal findings and analysis on unusual or suspicious business, whether or not a report results, and any relevant communications with the FIU. Its six years run from the latest of several events: the notification or report, the end of the business relationship, completion of the Transaction, the end of a related investigation, or a related judgment. Rule 4.5.4(d) requires records to be kept so that all internal notifications and SAR/STRs can be identified.

Chapter 13: the route only works if people know it

Rule 13.1.1(b) requires training that enables Employees to know the identity and responsibilities of the MLRO and their deputy, to understand the types of activity that may constitute suspicious activity in the context of their own business and may warrant an internal notification, and to understand the firm’s arrangements for making one. Training must also be tailored to the firm’s activities, including its products, services, customers, distribution channels and business partners.

Rule 13.2.1 requires training for all Employees at least annually. Guidance speaks of relevant Employees, of intervals appropriate to the role, and of training new relevant Employees as soon as reasonably practicable after they start. It also says training need not be in a classroom. Rule 13.3 requires a record of the dates, the nature of the training and the names of those trained, kept for at least six years from the date it was given.

Four things worth doing

Time the route on your last few files. Measure from the Employee’s first awareness to the notification, the determination and the filing. With no number in the Rule, your own recorded standard and your reasons for any gap are what you can show. We would set that standard against the federal words, immediately and without delay, rather than the softer-sounding as soon as practicable.
Read your procedure against the line-manager Guidance. If a template or a workflow routes a concern through a manager, check that it cannot stop there, and say so in the training.
Keep the “no report” file as carefully as the report. Rules 14.3.2 and 14.3.3 both ask for reasons, and Rule 4.5.1 keeps the analysis either way. Set your retention by Rule 4.5.1’s latest-event test, since a flat six years from the report under Rule 14.5.1 can run out sooner.
Check the population in your training log. Compare it with the Glossary’s definition of Employee, including people placed with you by a third party, and keep to the annual minimum in Rule 13.2.1 for all of them.

SonarPulse in this jurisdiction: AML/CFT screening software for the UAE, ADGM and DIFC

Sources

This article draws on the following sources. Follow the links for the original text.

For information only. This briefing is not legal advice: check the cited sources and take advice on your own position.

AML compliance financial-crime intermediate jurisdiction-briefing know-your-regulator united-arab-emirates united-arab-emirates-abu-dhabi-adgm